added HTML escape